Resurgence Of The Mexals Cryptojacking Campaign

The Mexals crypto jacking campaign has been in operation since at least 2021 and continues to evolve. A new wave of attacks started in late 2022 with new functionality including SSH worm and LAN spreader modules and improved obfuscation. The malicious software kills competitor miners and CPU-heavy processes clears command history for defense evasion and creates a cron job for persistence.